I started with kube-proxy and iptables rules, explained how rules get programmed per Service, then pivoted to IPVS as the more scalable option for large clusters.
Start by framing the problem: a client sends a request to a Service, which is a stable virtual IP. Then explain how kube-proxy programs the data plane (iptables or IPVS) to load-balance and DNAT the request to a backend pod. Finish by walking through the packet's journey, highlighting the role of conntrack and the differences between iptables and IPVS modes.
Pro tip: Mention that iptables mode uses random selection with O(1) complexity but can become slow with thousands of services, while IPVS uses hash tables and supports more load-balancing algorithms, making it more scalable. Also note that kube-proxy is not in the data path—it only programs rules.
Explain that a Kubernetes Service provides a stable virtual IP (ClusterIP) and DNS name. The kube-proxy watches Services and Endpoints (or EndpointSlices) to know which pods back the service.
Describe the two main modes: iptables and IPVS. In iptables mode, kube-proxy creates NAT rules to randomly select a backend pod. In IPVS mode, it uses a virtual server with real servers and supports scheduling algorithms like round-robin.
Walk through the packet: client sends to Service IP:port. The packet hits the host's network stack, where iptables/IPVS rules DNAT the destination to a chosen pod IP:port. Conntrack records the connection for return traffic.
The packet is routed to the pod's network namespace (via veth pair, CNI). The pod responds, and the reply packet is un-DNATed by conntrack so it appears to come from the Service IP. The client sees a seamless connection.
Discuss trade-offs: iptables is simple but scales poorly with many services; IPVS is more scalable but adds complexity. Mention session affinity, externalTrafficPolicy, and how kube-proxy handles nodePort and loadBalancer services.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by defining each service type in terms of its scope (internal vs external) and how traffic reaches pods. Then explain the trade-offs in terms of exposure, cost, and operational complexity, and finally give concrete use cases for each. Emphasize that these are not mutually exclusive and often used together.
Pro tip: Mention that LoadBalancer typically provisions a cloud provider's external load balancer, which incurs cost and may require additional configuration for TLS termination or health checks. Also note that NodePort is often used for debugging or when you need direct access to a specific node, but it's rarely the final production solution.
Explain that ClusterIP is the default service type, providing an internal virtual IP reachable only within the cluster. It's used for inter-service communication and is not exposed externally.
Describe NodePort as a service that exposes the service on each node's IP at a static port (30000-32767). It allows external access via any node's IP and port, but lacks load balancing and requires managing node IPs.
Explain that LoadBalancer builds on NodePort and ClusterIP, and provisions an external load balancer (e.g., AWS ELB, GCP LB) that routes traffic to the service. It provides a single external IP and handles load balancing.
Discuss trade-offs: ClusterIP is simple and secure but internal-only; NodePort is simple but exposes high ports and lacks LB; LoadBalancer is production-ready for external traffic but adds cost and cloud dependency.
Give concrete scenarios: ClusterIP for microservice-to-microservice calls; NodePort for dev/test or when you need direct node access; LoadBalancer for exposing a public-facing web app or API.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Talked through CoreDNS, the cluster DNS suffix, and how pods get their resolv.conf configured.
Start by explaining the role of CoreDNS as the cluster DNS provider and how it watches the Kubernetes API for Service and Endpoint changes. Then describe the DNS resolution flow: a pod's DNS query for a Service name is resolved by CoreDNS to the Service's ClusterIP (for ClusterIP type) or to individual pod IPs (for headless services). Finally, mention the different DNS record types (A, SRV, PTR) and how they map to Kubernetes objects.
Pro tip: Emphasize that DNS-based service discovery is not just about resolving names to IPs but also about load balancing and failover, as kube-proxy handles the actual traffic distribution. Also, mention that CoreDNS can be customized with plugins and that DNS caching (e.g., ndots) can affect resolution behavior.
Explain that CoreDNS is the default DNS server in Kubernetes, deployed as a Deployment and exposed via a Service. It watches the Kubernetes API for Service and Endpoint objects to maintain DNS records.
Detail how CoreDNS creates A records for Services (pointing to ClusterIP) and for headless Services (pointing to pod IPs). Mention SRV records for named ports and PTR records for reverse lookups.
Walk through a pod's DNS query: the pod's resolv.conf points to the kube-dns Service IP, which routes to CoreDNS. CoreDNS resolves the query based on its records and returns the IP(s).
Differentiate between ClusterIP, headless, and ExternalName Services. ClusterIP resolves to a single virtual IP; headless resolves to multiple pod IPs; ExternalName resolves to an external CNAME.
Clarify that DNS returns the ClusterIP, and kube-proxy (iptables/IPVS) handles load balancing to backend pods. For headless services, the client is responsible for load balancing.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Walk through the end-to-end traffic flow from the external client to the pod, highlighting where the Ingress controller sits and what it does at each hop. Emphasize that the Ingress controller is both a reverse proxy and a Kubernetes controller that watches Ingress resources and configures itself dynamically. Use a concrete example (e.g., nginx) to make the explanation tangible.
Pro tip: Mention that the Ingress controller itself runs as a pod (often behind a LoadBalancer Service) and that it routes based on host/path rules defined in Ingress objects, not by directly managing iptables. This shows you understand the separation between control plane and data plane.
Start with the client sending a request to a domain name that resolves to an external IP (e.g., a cloud load balancer). Explain that this IP is typically provisioned by a Service of type LoadBalancer or NodePort that fronts the Ingress controller pods.
The Ingress controller (e.g., nginx) terminates TLS, inspects the HTTP host header and path, and matches them against Ingress rules it has programmed from the Kubernetes API. It then selects the appropriate backend Service.
The controller forwards the request to the Service's ClusterIP (or directly to pod IPs if using a service mesh or endpoint slicing). kube-proxy or the CNI then load-balances to one of the healthy pod endpoints backing that Service.
The request arrives at the pod's container, which processes it and sends a response back along the same path. Mention that the Ingress controller may also add headers like X-Forwarded-For to preserve client IP.
Explain that the Ingress controller continuously watches Ingress, Service, and Endpoint objects, so when pods scale or change, it updates its configuration without manual reloads. This ensures high availability and zero-downtime deployments.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.